@ai-sdk/mcp 2.0.31 → 2.0.33

package/dist/index.js

@@ -4,9 +4,11 @@ import { z as z2 } from "zod/v4";
 
 // src/tool/types.ts
 import { z } from "zod/v4";
-var LATEST_PROTOCOL_VERSION = "2025-11-25";
+var LATEST_PROTOCOL_VERSION = "2026-07-28";
+var LATEST_LEGACY_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
+  LATEST_LEGACY_PROTOCOL_VERSION,
   "2025-06-18",
   "2025-03-26",
   "2024-11-05"
@@ -20,7 +22,9 @@ var ClientOrServerImplementationSchema = z.looseObject({
 var BaseParamsSchema = z.looseObject({
   _meta: z.optional(z.object({}).loose())
 });
-var ResultSchema = BaseParamsSchema;
+var ResultSchema = BaseParamsSchema.extend({
+  resultType: z.optional(z.string())
+});
 var RequestSchema = z.object({
   method: z.string(),
   params: z.optional(BaseParamsSchema)
@@ -53,6 +57,13 @@ var ServerCapabilitiesSchema = z.looseObject({
 var ClientCapabilitiesSchema = z.object({
   elicitation: z.optional(ElicitationCapabilitySchema)
 }).loose();
+var DiscoverResultSchema = ResultSchema.extend({
+  supportedVersions: z.array(z.string()),
+  capabilities: ServerCapabilitiesSchema,
+  instructions: z.optional(z.string()),
+  ttlMs: z.optional(z.number()),
+  cacheScope: z.optional(z.union([z.literal("public"), z.literal("private")]))
+});
 var InitializeResultSchema = ResultSchema.extend({
   protocolVersion: z.string(),
   capabilities: ServerCapabilitiesSchema,
@@ -69,10 +80,10 @@ var ToolSchema = z.object({
    */
   title: z.optional(z.string()),
   description: z.optional(z.string()),
-  inputSchema: z.object({
-    type: z.literal("object"),
+  inputSchema: z.looseObject({
+    type: z.optional(z.unknown()),
     properties: z.optional(z.object({}).loose())
-  }).loose(),
+  }),
   /**
    * @see https://modelcontextprotocol.io/specification/2025-06-18/server/tools#output-schema
    */
@@ -261,7 +272,7 @@ var JSONRPCResponseSchema = z2.object({
 }).strict();
 var JSONRPCErrorSchema = z2.object({
   jsonrpc: z2.literal(JSONRPC_VERSION),
-  id: z2.union([z2.string(), z2.number().int()]),
+  id: z2.optional(z2.union([z2.string(), z2.number().int()])),
   error: z2.object({
     code: z2.number().int(),
     message: z2.string(),
@@ -369,6 +380,7 @@ var OAuthTokensSchema = z3.object({
   expires_in: z3.number().optional(),
   scope: z3.string().optional(),
   refresh_token: z3.string().optional(),
+  issuer: SafeUrlSchema.optional(),
   authorization_server: SafeUrlSchema.optional(),
   token_endpoint: SafeUrlSchema.optional()
 }).strip();
@@ -393,6 +405,8 @@ var OAuthMetadataSchema = z3.looseObject({
   authorization_endpoint: SafeUrlSchema,
   token_endpoint: SafeUrlSchema,
   registration_endpoint: SafeUrlSchema.optional(),
+  authorization_response_iss_parameter_supported: z3.boolean().optional(),
+  client_id_metadata_document_supported: z3.boolean().optional(),
   scopes_supported: z3.array(z3.string()).optional(),
   response_types_supported: z3.array(z3.string()),
   grant_types_supported: z3.array(z3.string()).optional(),
@@ -407,6 +421,8 @@ var OpenIdProviderMetadataSchema = z3.looseObject({
   userinfo_endpoint: SafeUrlSchema.optional(),
   jwks_uri: SafeUrlSchema,
   registration_endpoint: SafeUrlSchema.optional(),
+  authorization_response_iss_parameter_supported: z3.boolean().optional(),
+  client_id_metadata_document_supported: z3.boolean().optional(),
   scopes_supported: z3.array(z3.string()).optional(),
   response_types_supported: z3.array(z3.string()),
   grant_types_supported: z3.array(z3.string()).optional(),
@@ -425,11 +441,13 @@ var OAuthClientInformationSchema = z3.object({
   client_secret: z3.string().optional(),
   client_id_issued_at: z3.number().optional(),
   client_secret_expires_at: z3.number().optional(),
+  issuer: SafeUrlSchema.optional(),
   authorization_server: SafeUrlSchema.optional(),
   token_endpoint: SafeUrlSchema.optional()
 }).strip();
 var OAuthClientMetadataSchema = z3.object({
   redirect_uris: z3.array(SafeUrlSchema),
+  application_type: z3.union([z3.literal("native"), z3.literal("web")]).optional(),
   token_endpoint_auth_method: z3.string().optional(),
   grant_types: z3.array(z3.string()).optional(),
   response_types: z3.array(z3.string()).optional(),
@@ -534,8 +552,20 @@ var UnauthorizedError = class extends Error {
 function normalizeUrl(url) {
   return new URL(url).href;
 }
+function validateAuthorizationResponseIssuer({
+  callbackIssuer,
+  expectedIssuer
+}) {
+  if (callbackIssuer != null && callbackIssuer !== expectedIssuer) {
+    throw new MCPClientOAuthError({
+      message: `OAuth authorization response issuer ${callbackIssuer} does not match expected issuer ${expectedIssuer}`
+    });
+  }
+}
 function createAuthorizationServerInformation(authorizationServerUrl, metadata) {
+  var _a3;
   return {
+    issuer: (_a3 = metadata == null ? void 0 : metadata.issuer) != null ? _a3 : String(authorizationServerUrl),
     authorizationServerUrl: normalizeUrl(authorizationServerUrl),
     tokenEndpoint: normalizeUrl(
       (metadata == null ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl)
@@ -545,6 +575,7 @@ function createAuthorizationServerInformation(authorizationServerUrl, metadata)
 function addAuthorizationServerInformationToTokens(tokens, authorizationServerInformation) {
   return {
     ...tokens,
+    issuer: authorizationServerInformation.issuer,
     authorization_server: authorizationServerInformation.authorizationServerUrl,
     token_endpoint: authorizationServerInformation.tokenEndpoint
   };
@@ -552,6 +583,7 @@ function addAuthorizationServerInformationToTokens(tokens, authorizationServerIn
 function addAuthorizationServerInformationToClientInformation(clientInformation, authorizationServerInformation) {
   return {
     ...clientInformation,
+    issuer: authorizationServerInformation.issuer,
     authorization_server: authorizationServerInformation.authorizationServerUrl,
     token_endpoint: authorizationServerInformation.tokenEndpoint
   };
@@ -561,6 +593,7 @@ function getAuthorizationServerInformationFromCredentials(credentials) {
     return void 0;
   }
   return {
+    issuer: credentials.issuer,
     authorizationServerUrl: normalizeUrl(credentials.authorization_server),
     tokenEndpoint: normalizeUrl(credentials.token_endpoint)
   };
@@ -578,6 +611,7 @@ async function getStoredAuthorizationServerInformation({
   const providerAuthorizationServerInformation = await ((_a3 = provider.authorizationServerInformation) == null ? void 0 : _a3.call(provider));
   if (providerAuthorizationServerInformation) {
     return {
+      issuer: providerAuthorizationServerInformation.issuer,
       authorizationServerUrl: normalizeUrl(
         providerAuthorizationServerInformation.authorizationServerUrl
       ),
@@ -625,32 +659,47 @@ function assertAuthorizationServerInformationMatches({
   storedAuthorizationServerInformation,
   currentAuthorizationServerInformation
 }) {
-  if (storedAuthorizationServerInformation.authorizationServerUrl !== currentAuthorizationServerInformation.authorizationServerUrl || storedAuthorizationServerInformation.tokenEndpoint !== currentAuthorizationServerInformation.tokenEndpoint) {
+  if (storedAuthorizationServerInformation.issuer != null && currentAuthorizationServerInformation.issuer != null && storedAuthorizationServerInformation.issuer !== currentAuthorizationServerInformation.issuer || storedAuthorizationServerInformation.authorizationServerUrl !== currentAuthorizationServerInformation.authorizationServerUrl || storedAuthorizationServerInformation.tokenEndpoint !== currentAuthorizationServerInformation.tokenEndpoint) {
     throw new MCPClientOAuthError({
       message: "OAuth authorization server metadata does not match the metadata that issued the stored credentials"
     });
   }
 }
-function extractResourceMetadataUrl(response) {
-  var _a3;
+function extractWWWAuthenticateParams(response) {
+  var _a3, _b3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
   if (!header) {
-    return void 0;
+    return {};
   }
   const [type, scheme] = header.split(" ");
   if (type.toLowerCase() !== "bearer" || !scheme) {
-    return void 0;
-  }
-  const regex = /resource_metadata="([^"]*)"/;
-  const match = header.match(regex);
-  if (!match) {
-    return void 0;
+    return {};
   }
+  const resourceMetadataMatch = header.match(
+    /(?:^|[,\s])resource_metadata="([^"]*)"/i
+  );
+  const scope = (_b3 = header.match(/(?:^|[,\s])scope="([^"]*)"/i)) == null ? void 0 : _b3[1];
+  let resourceMetadataUrl;
   try {
-    return new URL(match[1]);
+    resourceMetadataUrl = resourceMetadataMatch ? new URL(resourceMetadataMatch[1]) : void 0;
   } catch (e) {
-    return void 0;
   }
+  return { resourceMetadataUrl, scope };
+}
+function selectScope({
+  scope,
+  resourceMetadata,
+  clientMetadata
+}) {
+  var _a3;
+  if (scope) {
+    return scope;
+  }
+  const resourceScopes = (_a3 = resourceMetadata == null ? void 0 : resourceMetadata.scopes_supported) == null ? void 0 : _a3.join(" ");
+  if (resourceScopes) {
+    return resourceScopes;
+  }
+  return clientMetadata.scope;
 }
 function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   if (pathname.endsWith("/")) {
@@ -1059,6 +1108,7 @@ async function registerClient(authorizationServerUrl, {
   clientMetadata,
   fetchFn
 }) {
+  var _a3;
   let registrationUrl;
   if (metadata) {
     if (!metadata.registration_endpoint) {
@@ -1070,18 +1120,29 @@ async function registerClient(authorizationServerUrl, {
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
+  const applicationType = (_a3 = clientMetadata.application_type) != null ? _a3 : inferOAuthApplicationType(clientMetadata.redirect_uris);
   const response = await (fetchFn != null ? fetchFn : fetch)(registrationUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(clientMetadata)
+    body: JSON.stringify({
+      ...clientMetadata,
+      application_type: applicationType
+    })
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
   return OAuthClientInformationFullSchema.parse(await response.json());
 }
+function inferOAuthApplicationType(redirectUris) {
+  const isNativeRedirectUri = (redirectUri) => {
+    const url = new URL(redirectUri);
+    return (url.protocol === "http:" || url.protocol === "https:") && (url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]") || url.protocol !== "http:" && url.protocol !== "https:";
+  };
+  return redirectUris.every(isNativeRedirectUri) ? "native" : "web";
+}
 async function auth(provider, options) {
   var _a3, _b3;
   try {
@@ -1122,11 +1183,12 @@ async function authInternal(provider, {
   serverUrl,
   authorizationCode,
   callbackState,
+  callbackIssuer,
   scope,
   resourceMetadataUrl,
   fetchFn
 }) {
-  var _a3, _b3;
+  var _a3, _b3, _c, _d;
   let resourceMetadata;
   let authorizationServerUrl;
   assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
@@ -1162,6 +1224,18 @@ async function authInternal(provider, {
   );
   const currentAuthorizationServerInformation = createAuthorizationServerInformation(authorizationServerUrl, metadata);
   let clientInformation = await Promise.resolve(provider.clientInformation());
+  if ((clientInformation == null ? void 0 : clientInformation.issuer) != null) {
+    const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation
+    });
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation
+      });
+    }
+  }
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error(
@@ -1202,6 +1276,10 @@ async function authInternal(provider, {
         message: "Stored OAuth authorization server metadata is required when exchanging an authorization code"
       });
     }
+    validateAuthorizationResponseIssuer({
+      callbackIssuer,
+      expectedIssuer: (_c = (_b3 = storedAuthorizationServerInformation.issuer) != null ? _b3 : metadata == null ? void 0 : metadata.issuer) != null ? _c : String(authorizationServerUrl)
+    });
     assertAuthorizationServerInformationMatches({
       storedAuthorizationServerInformation,
       currentAuthorizationServerInformation
@@ -1238,7 +1316,7 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
+      await ((_d = provider.invalidateCredentials) == null ? void 0 : _d.call(provider, "tokens"));
     }
     try {
       if (storedAuthorizationServerInformation) {
@@ -1279,7 +1357,11 @@ async function authInternal(provider, {
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: selectScope({
+        scope,
+        resourceMetadata,
+        clientMetadata: provider.clientMetadata
+      }),
       resource
     }
   );
@@ -1325,7 +1407,7 @@ var SseMCPTransport = class {
     const headers = {
       ...this.headers,
       ...base,
-      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION
+      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_LEGACY_PROTOCOL_VERSION
     };
     if (this.authProvider) {
       const tokens = await this.authProvider.tokens();
@@ -1357,11 +1439,13 @@ var SseMCPTransport = class {
             redirect: this.redirectMode
           });
           if (response.status === 401 && this.authProvider && !triedAuth) {
-            this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+            const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+            this.resourceMetadataUrl = resourceMetadataUrl;
             try {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                scope,
                 fetchFn: this.fetchFn
               });
               if (result !== "AUTHORIZED") {
@@ -1490,11 +1574,13 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              scope,
               fetchFn: this.fetchFn
             });
             if (result !== "AUTHORIZED") {
@@ -1534,6 +1620,107 @@ import {
   withUserAgentSuffix as withUserAgentSuffix2,
   getRuntimeEnvironmentUserAgent as getRuntimeEnvironmentUserAgent2
 } from "@ai-sdk/provider-utils";
+
+// src/tool/mcp-http-headers.ts
+import { convertUint8ArrayToBase64, isRecord } from "@ai-sdk/provider-utils";
+var HTTP_TOKEN_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var BASE64_SENTINEL_PATTERN = /^=\?base64\?.*\?=$/;
+function encodeMCPHeaderValue(value) {
+  const isPlainAscii = [...value].every((character) => {
+    const code = character.charCodeAt(0);
+    return code === 9 || code >= 32 && code <= 126;
+  });
+  if (isPlainAscii && value.trim() === value && !BASE64_SENTINEL_PATTERN.test(value)) {
+    return value;
+  }
+  return `=?base64?${convertUint8ArrayToBase64(new TextEncoder().encode(value))}?=`;
+}
+function getMCPToolHeaderBindings(inputSchema) {
+  if (!isRecord(inputSchema)) {
+    return {
+      success: false,
+      error: "inputSchema must be a JSON Schema object"
+    };
+  }
+  const bindings = [];
+  const headerNames = /* @__PURE__ */ new Set();
+  let error;
+  const visit = (value, path, staticallyReachable) => {
+    if (error != null || !isRecord(value)) {
+      return;
+    }
+    if ("x-mcp-header" in value) {
+      if (!staticallyReachable || path.length === 0) {
+        error = "x-mcp-header is not on a statically reachable property";
+        return;
+      }
+      const headerName = value["x-mcp-header"];
+      if (typeof headerName !== "string" || !HTTP_TOKEN_PATTERN.test(headerName)) {
+        error = "x-mcp-header must be a non-empty HTTP token";
+        return;
+      }
+      const normalizedHeaderName = headerName.toLowerCase();
+      if (headerNames.has(normalizedHeaderName)) {
+        error = `x-mcp-header value "${headerName}" is not unique`;
+        return;
+      }
+      const valueType = value.type;
+      if (valueType !== "boolean" && valueType !== "integer" && valueType !== "string") {
+        error = "x-mcp-header can only annotate boolean, integer, or string properties";
+        return;
+      }
+      headerNames.add(normalizedHeaderName);
+      bindings.push({ headerName, path, valueType });
+    }
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "x-mcp-header") {
+        continue;
+      }
+      if (key === "properties" && isRecord(child)) {
+        for (const [propertyName, propertySchema] of Object.entries(child)) {
+          visit(propertySchema, [...path, propertyName], staticallyReachable);
+        }
+      } else {
+        visit(child, path, false);
+      }
+    }
+  };
+  visit(inputSchema, [], true);
+  return error == null ? { success: true, bindings } : { success: false, error };
+}
+function getValueAtPath(value, path) {
+  let current = value;
+  for (const segment of path) {
+    if (!isRecord(current)) {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function createMCPToolHeaders({
+  bindings,
+  args
+}) {
+  const headers = {};
+  for (const binding of bindings) {
+    const value = getValueAtPath(args, binding.path);
+    if (value == null) {
+      continue;
+    }
+    if (binding.valueType === "string" && typeof value !== "string" || binding.valueType === "boolean" && typeof value !== "boolean" || binding.valueType === "integer" && !Number.isSafeInteger(value)) {
+      throw new TypeError(
+        `Tool argument "${binding.path.join(".")}" does not match its x-mcp-header type`
+      );
+    }
+    headers[`Mcp-Param-${binding.headerName}`] = encodeMCPHeaderValue(
+      String(value)
+    );
+  }
+  return headers;
+}
+
+// src/tool/mcp-http-transport.ts
 function isMessageEvent2(event) {
   return event === void 0 || event === "message";
 }
@@ -1550,6 +1737,8 @@ var HttpMCPTransport = class {
     terminateSessionOnClose = true,
     fetch: fetchFn
   }) {
+    this.supportsProtocolVersionDiscovery = true;
+    this.supportsMcpToolParameterHeaders = true;
     this.inboundReconnectAttempts = 0;
     this.reconnectionOptions = {
       initialReconnectionDelay: 1e3,
@@ -1562,14 +1751,30 @@ var HttpMCPTransport = class {
     this.authProvider = authProvider;
     this.redirectMode = redirect;
     this.sessionId = initialSessionId;
-    this.protocolVersion = initialProtocolVersion;
+    this.protocolVersion = initialProtocolVersion != null ? initialProtocolVersion : LATEST_LEGACY_PROTOCOL_VERSION;
     this.onSessionIdChange = onSessionIdChange;
     this.onSessionExpired = onSessionExpired;
     this.terminateSessionOnClose = terminateSessionOnClose;
     this.fetchFn = fetchFn != null ? fetchFn : globalThis.fetch;
   }
   setProtocolVersion(version) {
+    var _a3;
     this.protocolVersion = version;
+    if (!this.abortController) {
+      return;
+    }
+    if (this.isModernProtocol()) {
+      (_a3 = this.inboundSseConnection) == null ? void 0 : _a3.close();
+      this.inboundSseConnection = void 0;
+      return;
+    }
+    if (!this.inboundSseConnection) {
+      this.startInboundSse();
+    }
+  }
+  isModernProtocol() {
+    var _a3;
+    return ((_a3 = this.protocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION) === LATEST_PROTOCOL_VERSION;
   }
   async commonHeaders({
     base,
@@ -1579,9 +1784,9 @@ var HttpMCPTransport = class {
     const headers = {
       ...this.headers,
       ...base,
-      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION
+      "mcp-protocol-version": (_a3 = this.protocolVersion) != null ? _a3 : LATEST_LEGACY_PROTOCOL_VERSION
     };
-    if (includeSessionId && this.sessionId) {
+    if (!this.isModernProtocol() && includeSessionId && this.sessionId) {
       headers["mcp-session-id"] = this.sessionId;
     }
     if (this.authProvider) {
@@ -1605,6 +1810,9 @@ var HttpMCPTransport = class {
     (_a3 = this.onSessionIdChange) == null ? void 0 : _a3.call(this, sessionId);
   }
   applySessionIdFromResponse(response) {
+    if (this.isModernProtocol()) {
+      return;
+    }
     const sessionId = response.headers.get("mcp-session-id");
     if (sessionId) {
       this.setSessionId(sessionId);
@@ -1620,7 +1828,7 @@ var HttpMCPTransport = class {
   /**
    * Runs a single OAuth recovery flow for concurrent 401 responses.
    */
-  authorizeOnce(resourceMetadataUrl) {
+  authorizeOnce(resourceMetadataUrl, scope) {
     if (!this.authProvider) {
       return Promise.resolve("REDIRECT");
     }
@@ -1628,6 +1836,7 @@ var HttpMCPTransport = class {
       this.authPromise = auth(this.authProvider, {
         serverUrl: this.url,
         resourceMetadataUrl,
+        scope,
         fetchFn: this.fetchFn
       }).finally(() => {
         this.authPromise = void 0;
@@ -1642,14 +1851,16 @@ var HttpMCPTransport = class {
       });
     }
     this.abortController = new AbortController();
-    this.startInboundSse();
+    if (this.protocolVersion != null && this.protocolVersion !== LATEST_PROTOCOL_VERSION) {
+      this.startInboundSse();
+    }
   }
   async close(options) {
     var _a3, _b3, _c, _d, _e;
     (_a3 = this.inboundSseConnection) == null ? void 0 : _a3.close();
     (_b3 = this.abortController) == null ? void 0 : _b3.abort();
     try {
-      if (this.sessionId && this.terminateSessionOnClose && this.abortController) {
+      if (!this.isModernProtocol() && this.sessionId && this.terminateSessionOnClose && this.abortController) {
         (_c = options == null ? void 0 : options.signal) == null ? void 0 : _c.throwIfAborted();
         const headers = await this.commonHeaders({ base: {} });
         (_d = options == null ? void 0 : options.signal) == null ? void 0 : _d.throwIfAborted();
@@ -1670,14 +1881,16 @@ var HttpMCPTransport = class {
     const transportSignal = (_b3 = this.abortController) == null ? void 0 : _b3.signal;
     const requestSignal = (options == null ? void 0 : options.signal) == null ? transportSignal : transportSignal == null ? options.signal : AbortSignal.any([transportSignal, options.signal]);
     const attempt = async (triedAuth = false) => {
-      var _a4, _b4, _c, _d, _e, _f, _g;
+      var _a4, _b4, _c, _d, _e, _f, _g, _h;
       try {
         const isInitializeRequest = "method" in message && message.method === "initialize";
         const sessionIdForRequest = isInitializeRequest ? void 0 : this.sessionId;
         const headers = await this.commonHeaders({
           base: {
             "Content-Type": "application/json",
-            Accept: "application/json, text/event-stream"
+            Accept: "application/json, text/event-stream",
+            ...this.isModernProtocol() ? options == null ? void 0 : options.headers : {},
+            ...this.isModernProtocol() && "method" in message && "id" in message ? this.getStandardRequestHeaders(message) : {}
           },
           includeSessionId: !isInitializeRequest
         });
@@ -1691,9 +1904,13 @@ var HttpMCPTransport = class {
         const response = await this.fetchFn(this.url.href, init);
         this.applySessionIdFromResponse(response);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
-            const result = await this.authorizeOnce(this.resourceMetadataUrl);
+            const result = await this.authorizeOnce(
+              this.resourceMetadataUrl,
+              scope
+            );
             if (result !== "AUTHORIZED") {
               const error2 = new UnauthorizedError();
               throw error2;
@@ -1705,19 +1922,31 @@ var HttpMCPTransport = class {
           return attempt(true);
         }
         if (response.status === 202) {
-          if (!this.inboundSseConnection) {
+          if (!this.isModernProtocol() && !this.inboundSseConnection) {
             this.startInboundSse();
           }
           return;
         }
         if (!response.ok) {
           const text = await response.text().catch(() => null);
+          if ("id" in message && text != null) {
+            const jsonRpcMessage = await parseJSONRPCMessage(text).catch(
+              () => void 0
+            );
+            if (jsonRpcMessage != null && "error" in jsonRpcMessage) {
+              (_b4 = this.onmessage) == null ? void 0 : _b4.call(
+                this,
+                jsonRpcMessage.id == null ? { ...jsonRpcMessage, id: message.id } : jsonRpcMessage
+              );
+              return;
+            }
+          }
           let errorMessage = `MCP HTTP Transport Error: POSTing to endpoint (HTTP ${response.status}): ${text}`;
           if (response.status === 404) {
-            if (sessionIdForRequest) {
+            if (!this.isModernProtocol() && sessionIdForRequest) {
               this.expireSessionId(sessionIdForRequest);
               errorMessage += ". The MCP session expired. Create a new client without `initialSessionId` to start a fresh session";
-            } else {
+            } else if (!this.isModernProtocol()) {
               errorMessage += ". This server does not support HTTP transport. Try using `sse` transport instead";
             }
           }
@@ -1727,7 +1956,7 @@ var HttpMCPTransport = class {
             url: this.url.href,
             responseBody: text != null ? text : void 0
           });
-          (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error2);
+          (_c = this.onerror) == null ? void 0 : _c.call(this, error2);
           throw error2;
         }
         const isNotification = !("id" in message);
@@ -1739,7 +1968,7 @@ var HttpMCPTransport = class {
           const data = await response.json();
           const messages = Array.isArray(data) ? data.map((message2) => validateJSONRPCMessage(message2)) : [validateJSONRPCMessage(data)];
           for (const jsonRpcMessage of messages) {
-            (_c = this.onmessage) == null ? void 0 : _c.call(this, jsonRpcMessage);
+            (_d = this.onmessage) == null ? void 0 : _d.call(this, jsonRpcMessage);
           }
           return;
         }
@@ -1750,7 +1979,7 @@ var HttpMCPTransport = class {
               statusCode: response.status,
               url: this.url.href
             });
-            (_d = this.onerror) == null ? void 0 : _d.call(this, error2);
+            (_e = this.onerror) == null ? void 0 : _e.call(this, error2);
             throw error2;
           }
           const stream = response.body.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream2());
@@ -1796,18 +2025,29 @@ var HttpMCPTransport = class {
           statusCode: response.status,
           url: this.url.href
         });
-        (_e = this.onerror) == null ? void 0 : _e.call(this, error);
+        (_f = this.onerror) == null ? void 0 : _f.call(this, error);
         throw error;
       } catch (error) {
-        if ((_f = options == null ? void 0 : options.signal) == null ? void 0 : _f.aborted) {
+        if ((_g = options == null ? void 0 : options.signal) == null ? void 0 : _g.aborted) {
           throw error;
         }
-        (_g = this.onerror) == null ? void 0 : _g.call(this, error);
+        (_h = this.onerror) == null ? void 0 : _h.call(this, error);
         throw error;
       }
     };
     await attempt();
   }
+  getStandardRequestHeaders(message) {
+    const headers = {
+      "Mcp-Method": message.method
+    };
+    const params = message.params;
+    const name3 = message.method === "resources/read" ? params == null ? void 0 : params.uri : message.method === "tools/call" || message.method === "prompts/get" ? params == null ? void 0 : params.name : void 0;
+    if (typeof name3 === "string") {
+      headers["Mcp-Name"] = encodeMCPHeaderValue(name3);
+    }
+    return headers;
+  }
   getNextReconnectionDelay(attempt) {
     const {
       initialReconnectionDelay,
@@ -1840,6 +2080,9 @@ var HttpMCPTransport = class {
     }, delay);
   }
   startInboundSse(triedAuth = false, resumeToken) {
+    if (this.isModernProtocol()) {
+      return;
+    }
     void this.openInboundSse(triedAuth, resumeToken).catch((error) => {
       var _a3;
       if (error instanceof Error && error.name === "AbortError") {
@@ -1851,6 +2094,9 @@ var HttpMCPTransport = class {
   // Open optional inbound SSE stream; best-effort and resumable
   async openInboundSse(triedAuth = false, resumeToken) {
     var _a3, _b3, _c, _d, _e, _f;
+    if (this.isModernProtocol()) {
+      return;
+    }
     try {
       const sessionIdForRequest = this.sessionId;
       const headers = await this.commonHeaders({
@@ -1869,9 +2115,13 @@ var HttpMCPTransport = class {
       });
       this.applySessionIdFromResponse(response);
       if (response.status === 401 && this.authProvider && !triedAuth) {
-        this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+        this.resourceMetadataUrl = resourceMetadataUrl;
         try {
-          const result = await this.authorizeOnce(this.resourceMetadataUrl);
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             const error = new UnauthorizedError();
             (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);
@@ -1969,11 +2219,15 @@ var HttpMCPTransport = class {
 
 // src/tool/mcp-transport.ts
 function createMcpTransport(config) {
+  var _a3;
   switch (config.type) {
     case "sse":
       return new SseMCPTransport(config);
     case "http":
-      return new HttpMCPTransport(config);
+      return new HttpMCPTransport({
+        ...config,
+        initialProtocolVersion: (_a3 = config.initialProtocolVersion) != null ? _a3 : LATEST_PROTOCOL_VERSION
+      });
     default:
       throw new MCPClientError({
         message: "Unsupported or invalid transport configuration. If you are using a custom transport, make sure it implements the MCPTransport interface."
@@ -2108,6 +2362,8 @@ async function readMCPAppResource({
 // src/tool/mcp-client.ts
 var CLIENT_VERSION = "1.0.0";
 var DEFAULT_MAX_TOOL_CALL_RETRIES = 0;
+var DEFAULT_PROTOCOL_DISCOVERY_TIMEOUT = 1e3;
+var MODERN_PROTOCOL_ERROR_CODES = [-32020, -32021, -32022];
 var DEFAULT_RETRY_ERROR_CODES = [
   "ConnectionRefused",
   "ConnectionClosed",
@@ -2233,23 +2489,28 @@ var DefaultMCPClient = class {
     maxRetries,
     capabilities,
     initialInitializeResult,
-    initializationOptions
+    initializationOptions,
+    protocolVersionDiscovery = true
   }) {
     this.requestMessageId = 0;
     this.responseHandlers = /* @__PURE__ */ new Map();
     this.serverCapabilities = {};
     this._serverInfo = { name: "", version: "" };
     this._initializeResult = {
-      protocolVersion: LATEST_PROTOCOL_VERSION,
+      protocolVersion: LATEST_LEGACY_PROTOCOL_VERSION,
       capabilities: {},
       serverInfo: this._serverInfo
     };
+    this.protocolEra = "legacy";
+    this.protocolVersion = LATEST_LEGACY_PROTOCOL_VERSION;
+    this.toolHeaderBindings = /* @__PURE__ */ new Map();
     this.isClosed = true;
     this.onUncaughtError = onUncaughtError;
     this.maxRetries = prepareMaxRetries(maxRetries);
     this.clientCapabilities = capabilities != null ? capabilities : {};
     this.initialInitializeResult = initialInitializeResult;
     this.initializationOptions = initializationOptions;
+    this.protocolVersionDiscovery = protocolVersionDiscovery;
     if (isCustomMcpTransport(transportConfig)) {
       this.transport = transportConfig;
     } else {
@@ -2313,11 +2574,20 @@ var DefaultMCPClient = class {
         this.applyInitializeResult(result2);
         return this;
       }
+      if (this.protocolVersionDiscovery && this.transport.supportsProtocolVersionDiscovery) {
+        const discovered = await this.tryProtocolDiscovery(signal);
+        if (discovered) {
+          return this;
+        }
+      }
+      this.protocolEra = "legacy";
+      this.protocolVersion = LATEST_LEGACY_PROTOCOL_VERSION;
+      this.setTransportProtocolVersion(this.protocolVersion);
       const result = await this.request({
         request: {
           method: "initialize",
           params: {
-            protocolVersion: LATEST_PROTOCOL_VERSION,
+            protocolVersion: LATEST_LEGACY_PROTOCOL_VERSION,
             capabilities: this.clientCapabilities,
             clientInfo: this.clientInfo
           }
@@ -2360,6 +2630,55 @@ var DefaultMCPClient = class {
       }
     }
   }
+  async tryProtocolDiscovery(signal) {
+    this.protocolEra = "modern";
+    this.protocolVersion = LATEST_PROTOCOL_VERSION;
+    this.setTransportProtocolVersion(this.protocolVersion);
+    try {
+      const result = await this.request({
+        request: { method: "server/discover" },
+        resultSchema: DiscoverResultSchema,
+        options: {
+          signal,
+          timeout: DEFAULT_PROTOCOL_DISCOVERY_TIMEOUT
+        }
+      });
+      this.applyDiscoverResult(result);
+      return true;
+    } catch (error) {
+      if (MCPClientError.isInstance(error) && error.code != null && MODERN_PROTOCOL_ERROR_CODES.includes(error.code)) {
+        throw error;
+      }
+      return false;
+    }
+  }
+  applyDiscoverResult(result) {
+    var _a3;
+    if (!result.supportedVersions.includes(this.protocolVersion)) {
+      throw new MCPClientError({
+        message: `Server does not support the requested protocol version: ${this.protocolVersion}`
+      });
+    }
+    const serverInfo = (_a3 = result._meta) == null ? void 0 : _a3["io.modelcontextprotocol/serverInfo"];
+    if (serverInfo != null && typeof serverInfo === "object" && "name" in serverInfo && typeof serverInfo.name === "string" && "version" in serverInfo && typeof serverInfo.version === "string") {
+      this._serverInfo = serverInfo;
+    }
+    this.serverCapabilities = result.capabilities;
+    this._serverInstructions = result.instructions;
+    this._initializeResult = {
+      protocolVersion: this.protocolVersion,
+      capabilities: result.capabilities,
+      serverInfo: this._serverInfo,
+      instructions: result.instructions
+    };
+  }
+  setTransportProtocolVersion(version) {
+    if (this.transport.setProtocolVersion) {
+      this.transport.setProtocolVersion(version);
+    } else {
+      this.transport.protocolVersion = version;
+    }
+  }
   applyInitializeResult(result) {
     if (!SUPPORTED_PROTOCOL_VERSIONS.includes(result.protocolVersion)) {
       throw new MCPClientError({
@@ -2367,13 +2686,11 @@ var DefaultMCPClient = class {
       });
     }
     this.serverCapabilities = result.capabilities;
+    this.protocolEra = "legacy";
+    this.protocolVersion = result.protocolVersion;
     this._serverInfo = result.serverInfo;
     this._initializeResult = result;
-    if (this.transport.setProtocolVersion) {
-      this.transport.setProtocolVersion(result.protocolVersion);
-    } else {
-      this.transport.protocolVersion = result.protocolVersion;
-    }
+    this.setTransportProtocolVersion(result.protocolVersion);
     this._serverInstructions = result.instructions;
   }
   async close() {
@@ -2382,15 +2699,13 @@ var DefaultMCPClient = class {
     await ((_a3 = this.transport) == null ? void 0 : _a3.close());
     this.onClose();
   }
-  send(message, signal) {
-    return this.transport.send(
-      message,
-      signal == null ? void 0 : { signal }
-    );
+  send(message, options) {
+    return options == null ? this.transport.send(message) : this.transport.send(message, options);
   }
   assertCapability(method) {
     switch (method) {
       case "initialize":
+      case "server/discover":
         break;
       case "completion/complete":
         if (!this.serverCapabilities.completions) {
@@ -2436,6 +2751,7 @@ var DefaultMCPClient = class {
     options
   }) {
     return new Promise((resolve, reject) => {
+      var _a3;
       if (this.isClosed) {
         return reject(
           new MCPClientError({
@@ -2451,11 +2767,24 @@ var DefaultMCPClient = class {
       const transportSignal = signal == null ? timeoutController == null ? void 0 : timeoutController.signal : timeoutController == null ? signal : AbortSignal.any([signal, timeoutController.signal]);
       let timeoutId;
       const messageId = this.requestMessageId++;
-      const jsonrpcRequest = {
+      const preparedRequest = this.protocolEra === "modern" ? {
         ...request,
+        params: {
+          ...request.params,
+          _meta: {
+            ...(_a3 = request.params) == null ? void 0 : _a3._meta,
+            "io.modelcontextprotocol/protocolVersion": this.protocolVersion,
+            "io.modelcontextprotocol/clientCapabilities": this.clientCapabilities,
+            "io.modelcontextprotocol/clientInfo": this.clientInfo
+          }
+        }
+      } : request;
+      const jsonrpcRequest = {
+        ...preparedRequest,
         jsonrpc: "2.0",
         id: messageId
       };
+      const headers = this.getToolRequestHeaders(preparedRequest);
       const rejectWithAbortError = () => {
         reject(
           new MCPClientError({
@@ -2495,11 +2824,21 @@ var DefaultMCPClient = class {
           return rejectAndCleanup(response);
         }
         try {
+          if (this.protocolEra === "modern" && response.result.resultType == null) {
+            throw new MCPClientError({
+              message: "Modern MCP result is missing resultType"
+            });
+          }
+          if (response.result.resultType === "input_required") {
+            throw new MCPClientError({
+              message: "Server requested additional input, but multi round-trip requests are not supported yet"
+            });
+          }
           const result = resultSchema.parse(response.result);
           cleanup();
           resolve(result);
         } catch (error) {
-          const parseError = new MCPClientError({
+          const parseError = MCPClientError.isInstance(error) ? error : new MCPClientError({
             message: "Failed to parse server response",
             cause: error
           });
@@ -2510,7 +2849,11 @@ var DefaultMCPClient = class {
       if (timeout != null) {
         timeoutId = setTimeout(onTimeout, timeout);
       }
-      const sendPromise = transportSignal == null ? this.transport.send(jsonrpcRequest) : this.send(jsonrpcRequest, transportSignal);
+      const sendOptions = {
+        ...transportSignal == null ? {} : { signal: transportSignal },
+        ...headers == null ? {} : { headers }
+      };
+      const sendPromise = Object.keys(sendOptions).length === 0 ? this.send(jsonrpcRequest) : this.send(jsonrpcRequest, sendOptions);
       sendPromise.catch((error) => {
         rejectAndCleanup(error);
       });
@@ -2520,11 +2863,59 @@ var DefaultMCPClient = class {
     params,
     options
   } = {}) {
-    return this.request({
+    const result = await this.request({
       request: { method: "tools/list", params },
       resultSchema: ListToolsResultSchema,
       options
     });
+    return this.prepareToolDefinitions(result, (params == null ? void 0 : params.cursor) == null);
+  }
+  prepareToolDefinitions(definitions, resetHeaderBindings = false) {
+    if (this.protocolEra !== "modern" || !this.transport.supportsMcpToolParameterHeaders) {
+      return definitions;
+    }
+    if (resetHeaderBindings) {
+      this.toolHeaderBindings.clear();
+    }
+    const tools = definitions.tools.filter((toolDefinition) => {
+      const result = getMCPToolHeaderBindings(toolDefinition.inputSchema);
+      if (!result.success) {
+        this.onError(
+          new MCPClientError({
+            message: `Ignoring MCP tool "${toolDefinition.name}": ${result.error}`
+          })
+        );
+        return false;
+      }
+      this.toolHeaderBindings.set(toolDefinition.name, result.bindings);
+      return true;
+    });
+    return { ...definitions, tools };
+  }
+  getToolRequestHeaders(request) {
+    var _a3;
+    if (this.protocolEra !== "modern" || request.method !== "tools/call" || typeof ((_a3 = request.params) == null ? void 0 : _a3.name) !== "string") {
+      return void 0;
+    }
+    const bindings = this.toolHeaderBindings.get(request.params.name);
+    if (bindings == null || bindings.length === 0) {
+      return void 0;
+    }
+    const args = request.params.arguments;
+    if (args == null || typeof args !== "object" || Array.isArray(args)) {
+      return void 0;
+    }
+    try {
+      return createMCPToolHeaders({
+        bindings,
+        args
+      });
+    } catch (error) {
+      throw new MCPClientError({
+        message: `Failed to create MCP headers for tool "${request.params.name}"`,
+        cause: error
+      });
+    }
   }
   async callToolWithRetry({
     options,
@@ -2650,7 +3041,10 @@ var DefaultMCPClient = class {
       jsonrpc: "2.0"
     };
     await waitForAbort(
-      this.send(jsonrpcNotification, options == null ? void 0 : options.signal),
+      this.send(
+        jsonrpcNotification,
+        (options == null ? void 0 : options.signal) == null ? void 0 : { signal: options.signal }
+      ),
       options == null ? void 0 : options.signal
     );
   }
@@ -2672,6 +3066,7 @@ var DefaultMCPClient = class {
    */
   toolsFromDefinitions(definitions, { schemas = "automatic" } = {}) {
     var _a3, _b3;
+    definitions = this.prepareToolDefinitions(definitions);
     const tools = {};
     for (const {
       name: name3,
@@ -2905,6 +3300,16 @@ var DefaultMCPClient = class {
     }
   }
   onResponse(response) {
+    if (response.id == null) {
+      this.onError(
+        new MCPClientError({
+          message: `Protocol error: Received a response without a message ID: ${JSON.stringify(
+            response
+          )}`
+        })
+      );
+      return;
+    }
     const messageId = Number(response.id);
     const handler = this.responseHandlers.get(messageId);
     if (handler === void 0) {
@@ -2927,7 +3332,7 @@ var DefaultMCPClient = class {
 };
 
 // src/tool/mcp-app-fingerprint.ts
-import { convertUint8ArrayToBase64 } from "@ai-sdk/provider-utils";
+import { convertUint8ArrayToBase64 as convertUint8ArrayToBase642 } from "@ai-sdk/provider-utils";
 var encoder = new TextEncoder();
 function canonicalJSON(value) {
   if (value == null || typeof value !== "object") {
@@ -2941,7 +3346,7 @@ function canonicalJSON(value) {
   return `{${entries.join(",")}}`;
 }
 function toBase64url(bytes) {
-  return convertUint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  return convertUint8ArrayToBase642(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 async function fingerprintMCPAppResource(resource) {
   var _a3, _b3, _c, _d;